Iran has been tracking American troops using data pulled directly from their own cell phones.
The Pentagon's phones have been part of that same problem.
And a Pentagon watchdog just finished an alarming audit of the phones American troops carry every day.
Pentagon Inspector General Finds 568,000 Military Phone Lines Exposed to Iran
The Department of War's Wireless Mobility Services contract – known as Spiral 4 – covered more than 568,000 service lines as of January 2026, reaching phones, tablets, and devices used by service members across every branch of the military.
The military locked down voice calls and email but left text messages completely unencrypted – wide open to anyone with the tools to intercept them.
The Pentagon's Office of Inspector General released its audit on October 9, and the findings should infuriate every American with family in uniform.
Officials in the chief information officer's office "accepted the operational risks from mobile device users sending unencrypted text messages using SMS messaging to meet mission needs by exception."
Pentagon bureaucrats carved out that exemption to cover texting journalists and recruiting potential enlistees – and left all of those phone lines unguarded in the process.
The IG report confirmed that officials "were aware that malicious actors could exploit known vulnerabilities to intercept and read SMS messages" sent to and from military devices. They knew and signed off anyway.
That sign-off is not bureaucratic shorthand for negligence. Accepting a risk by exception means an official assessed the vulnerability, documented it, and formally chose to leave it in place. Pentagon leadership looked at the threat and kept the exposure.
The vulnerability runs deeper than message content. Metadata – timestamps recording when messages were sent and origination points recording where – tells an adversary when a command post is active and where it sits.
According to the inspector general, enemies could use that data to "map entire communication networks within the DoW, pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security."
How Iran Used Military Location Data to Track and Target US Troops
In 2018, exercise app Strava published a global heat map that exposed the layouts of secret American military bases across the Middle East and Africa. The Pentagon issued warnings and banned geolocation features for troops in operational areas.
Eight years later, investigators found hundreds of service members at Iran-targeted bases still uploading their workouts to the app.
Personnel at Muwaffaq Al Salti Air Base in Jordan were among them. Iran attacked those barracks and killed three American soldiers.
A Navy contractor's Strava history showed him running near the base before the strike, then logging workouts in the courtyard of the Crowne Plaza hotel after military personnel relocated there. Six days later, Iran bombed the hotel.
Iran hunts location data because it works.
CENTCOM told lawmakers it had received multiple threat reports about adversaries exploiting commercial location data to target or surveil American personnel in the region.
Senators Ron Wyden and Eric Schmitt wrote to the Pentagon in late 2024 warning that foreign espionage groups were exploiting vulnerabilities in Department of War devices, and the Inspector General opened its investigation in response.
The Pentagon had already revised the Spiral 4 contracts to require independent security testing of wireless carriers, but the IG found no functioning review process for those assessments before contracts were renewed. The Pentagon acknowledged the risk, updated some paperwork, and left the exposure intact.
Pentagon Cell Phone Security Failures Left US Troops Exposed for Years
The inspector general's audit is the latest in a series of warnings since 2018 that Iran is weaponizing commercial technology against American troops – first through fitness apps that revealed base layouts, then through app location data used to target personnel inside those bases, and now through unprotected military phone lines that Pentagon career officials chose to leave open while filing their exception forms.
CENTCOM's commander warned deployed troops during the conflict that Iran was using "reactions, photos, and footage from the cellphones of our troops" to measure the success of its strikes and refine follow-on targeting.
Pentagon officials called unprotected SMS metadata an acceptable risk. Iran called it a targeting package, and 568,000 lines of it were sitting open.
The IG called for the chief information officer to assess what protections military metadata requires and to mandate third-party carrier security assessments before contract renewals. Neither action has been completed.
Pentagon career officials filed their exception paperwork and moved on. Iran has not.
Sources:
- Department of Defense Office of Inspector General, "Audit of the Security over the DoW's Unclassified Wireless Telecommunications Services Procured Through the Spiral 4 Contract," DoD OIG, October 9, 2026.
- Ben Smith, "Strava Is Still Exposing US Troop Locations in the Middle East Eight Years After Pentagon Warning," RedState, August 16, 2026.
- Staff, "Pentagon's wireless services left locations, data exposed, watchdog finds," Task & Purpose, October 17, 2026.
